CVE-2025-8064 is a stored cross-site scripting vulnerability in the Bible SuperSearch WordPress plugin by aicwebtech. The flaw exists in the handling of the 'selector_height' parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with Contributor-level privileges or above can exploit this to inject arbitrary web scripts into pages. These scripts execute in the context of users who access the injected pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to and including 6.0.1. The CVSS 3.1 base score is 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

Successful exploitation allows authenticated users with Contributor-level access or higher to inject persistent malicious scripts into pages generated by the plugin. These scripts execute in the browsers of users who view the compromised pages, potentially exposing sensitive information or enabling further attacks within the affected WordPress site. The vulnerability does not impact availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher privileges to trusted users only. Consider disabling or removing the Bible SuperSearch plugin if possible to reduce exposure. Monitor for updates from the vendor or WordPress plugin repository regarding patches or mitigations.